Breaking Changes

Ledger renamed to notebook — tools are now notebook_write, notebook_read, and notebook_index; /ledger is /notebook. Legacy ledger-entry session data still rehydrates so existing sessions keep their pages.
Handoff briefs no longer embed notebook bodies — referenced pages are fetched on demand via notebook_read. The brief carries only the task and primer; the notebook remains the long-term grounding store.
Handoff eligibility gate — handoff rejects empty briefs, sessions under ~30k tokens, or missing usage data so compaction cannot run without a real brief and a meaningful context load.
Human-set notebook topics are authoritative — the agent cannot override a topic the user set via /notebook or the topic UI.

Added

Readonly mode — /readonly, Ctrl+Shift+R, and --readonly toggle a session-persisted read-only posture. Write/edit are blocked; bash is classified and limited (allowlist / temp-only writes), with OS sandboxing on macOS (sandbox-exec) and Linux (bwrap) when available. Spawned children inherit the posture (no write/edit; guarded bash). Status shows 🔒 with gentle nudges. Handoff is blocked unless the user runs /handoff or crosses an eligible human topic boundary; readonly resumes after compaction.
Notebook topics — notebook_topic_set and /notebook <topic> set the active semantic frame (🧭 in the status bar). Topics clear after handoff so the next context assigns a fresh one. Topic-change boundary hints integrate with the watchdog.
Readonly frontmatter on skills and prompts — readonly: true defers enabling readonly when that skill or prompt is invoked.

Spawn tool inheritance — child agents inherit active registered parent tools executable in the child session, including MCP/extension tools, while still excluding spawn and handoff and keeping child-local notebook tools.
Topic- and readonly-aware watchdog — band-throttled primacy-zone nudges with copy that reflects the active topic and readonly state; warning widget at ≥70% context; malformed context percentages render as ctx --%.
Handoff lifecycle status — richer TUI status (requested / required / in progress), generation guards, and rejection of overlapping handoff attempts.
Notebook overlay and indicators — interactive /notebook overlay (renamed from /ledger) with subject-oriented page semantics; empty notebook count stays dim/discoverable rather than hidden without cue.

TUI-safe diagnostics — removed stderr/console logging that corrupted pi's ANSI TUI rendering from the extension host process.
Headless UI guards — ui.notify and readonly toggle no-op cleanly when no UI is attached instead of throwing.
Rehydration null-safety — notebook and readonly session resume no longer crash on missing or partial persisted state.